Fulltextsearch with AIO on Synology no longer compatible?

[rendam]

Just updated my AIO containers using the latest branch (Nextcloud 30) and had Imaginary and Fulltextsearch addons enabled through the AIO interface. This setup worked without issues until yesterday and now the fulltextsearch container does not start up due to missing seccomp feature of the Synology DSM kernel.

Is there some way to disable this (Somehow it should be possible to disable this on elasticsearch's end but i could not find a way for the containter to recognize this)?
Or where should i file an issue for that matter, cause the AIO container seems to be something different than https://github.com/nextcloud/fulltextsearch?

The log shows:

2024/12/17 17:11:39	stderr	ERROR: Elasticsearch died while starting up, with exit code 1
2024/12/17 17:11:39	stderr	
2024/12/17 17:11:39	stderr	ERROR: Elasticsearch did not exit normally - check the logs at /usr/share/elasticsearch/logs/nextcloud-aio.log
2024/12/17 17:11:39	stdout	{"@timestamp":"2024-12-17T16:11:39.547Z", "log.level":"ERROR", "message":"fatal exception while booting Elasticsearch", "ecs.version": "1.2.0","service.name":"ES_ECS","event.dataset":"elasticsearch.server","process.thread.name":"main","log.logger":"org.elasticsearch.bootstrap.Elasticsearch","elasticsearch.node.name":"fe1e99cb4a59","elasticsearch.cluster.name":"nextcloud-aio","error.type":"java.lang.UnsupportedOperationException","error.message":"seccomp unavailable: CONFIG_SECCOMP not compiled into kernel, CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed","error.stack_trace":"java.lang.UnsupportedOperationException: seccomp unavailable: CONFIG_SECCOMP not compiled into kernel, CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed\n\tat org.elasticsearch.nativeaccess@8.16.1/org.elasticsearch.nativeaccess.LinuxNativeAccess.tryInstallExecSandbox(LinuxNativeAccess.java:255)\n\tat org.elasticsearch.server@8.16.1/org.elasticsearch.bootstrap.Elasticsearch.initializeNatives(Elasticsearch.java:296)\n\tat org.elasticsearch.server@8.16.1/org.elasticsearch.bootstrap.Elasticsearch.initPhase2(Elasticsearch.java:169)\n\tat org.elasticsearch.server@8.16.1/org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:74)\n"}
2024/12/17 17:11:39	stdout	{"@timestamp":"2024-12-17T16:11:39.540Z", "log.level": "INFO", "message":"Using [jdk] native provider and native methods for [Linux]", "ecs.version": "1.2.0","service.name":"ES_ECS","event.dataset":"elasticsearch.server","process.thread.name":"main","log.logger":"org.elasticsearch.nativeaccess.NativeAccess","elasticsearch.node.name":"fe1e99cb4a59","elasticsearch.cluster.name":"nextcloud-aio"}
2024/12/17 17:11:39	stdout	{"@timestamp":"2024-12-17T16:11:39.474Z", "log.level": "INFO", "message":"Using native vector library; to disable start with -Dorg.elasticsearch.nativeaccess.enableVectorLibrary=false", "ecs.version": "1.2.0","service.name":"ES_ECS","event.dataset":"elasticsearch.server","process.thread.name":"main","log.logger":"org.elasticsearch.nativeaccess.NativeAccess","elasticsearch.node.name":"fe1e99cb4a59","elasticsearch.cluster.name":"nextcloud-aio"}
2024/12/17 17:11:37	stdout	CompileCommand: dontinline java/lang/invoke/MethodHandle.asTypeUncached bool dontinline = true
2024/12/17 17:11:37	stdout	CompileCommand: dontinline java/lang/invoke/MethodHandle.setAsTypeCache bool dontinline = true 

And disabling this should be possible with one of the 2 env vars (bootstrap.system_call_filter) like here

[vmpr]

I have the same problem, did you find a solution?

[rendam]

Sadly not. I had to remove the container for the time being until I find the time to dig deeper into the fulltextsearch container.
What I tried as well was completely deleting the container and data and adding it again through the AIO interface for it to start fresh. Same issue that the container won't start as the seccomp dependency seems mandatory by default.

[felix-berlin]

Have the same issue. I just removed the container for now.

[szaimen]

Hey, so if we set bootstrap.system_call_filter=false, the container will work again? Have you tested and verified this already?

[szaimen]

https://stackoverflow.com/questions/50314586/elasticsearch-fails-to-start-config-seccomp-and-config-seccomp-filter-are-neede#comment126562331_50314587 🙈

[szaimen]

So looks like elasticsearch is not working without seccomp anymore...

[rendam]

Thanks for looking into this. A real bummer that as it seems won't be possible to use that feature on a Synology in the foreseeable future. And as the fulltextsearch app now only supporting Elasticsearch I need to look into other ways to index my data.

[marceloexc]

did you ever find another way to index data?

[rendam]

I did not look into this since then. I‘m using Nextcloud without fulltext search for the time being until i migrate it to a host with a more recent kernel.

Maybe the change here helps?
#5768 (comment)

[szaimen]

See #5775 and https://www.elastic.co/guide/en/elasticsearch/reference/8.17/bootstrap-checks-syscall-filter.html

[ngdangtu-vn]

To check if your kernel support seccomp, use this command:

cat /proc/self/status

If you see this Seccomp: 0 then seccomp is disabled (source). Is it possible to enable it without recompile the kernel (or change to a new pc) is still a myst to me.

[Michael-XKCD]

For Unraid, I found this to be a good check:

docker info --format '{{.SecurityOptions}}'

You should see something like:
[name=seccomp,profile=builtin name=cgroupns]

Follow that up with something like this:

docker run --rm alpine sh -c "cat /proc/self/status | grep -i Seccomp"

You should see something like this:
Seccomp: 2
Seccomp_filters: 1 (something non-zero)

If your output looks like that, it means seccomp is enabled and enforced inside containers. So you're good to go.
cat /proc/self/status can be a false negative (at least on Unraid).

[dinccey]

I ran these commands and they suggest that seccomp is enabled and workin, but when I try to enable the FTS container, it remains disabled. Any idea how to fix that?

[elvismercado]

I'm having same issue that dinccey is having, already for quite a while.
Even now that im on Nextcloud AIO v12.8.0.
Running Unraid which shows Seccomp 0, but inside containers Seccomp = 2.

[maveice]

Solution:

1. Open AIO Interface → Disable FTS → "Stop containers"
2. Delete old Elasticsearch volume
   sudo docker volume rm nextcloud_aio_elasticsearch
3. AIO Interface → Restart containers → Re-enable FTS
4. After successful startup:
   In Nextcloud (AIO master container), have the index rebuilt:
   bashsudo docker exec --user www-data nextcloud-aio-nextcloud php occ fulltextsearch:index

HAPPY indexing!

[Lazymin3r]

Thank you, FTS was preventing apache/nextcloud/redis containers from being pulled/statrted after an upgrade to v13.1.0 (was receiving Slim Application Error). I figured out FTS was the cause, but your solution allowed me to use FTS after verifying that Seccom was enabled on my CPU.